by: Melissa Bank Stepno, Vice President of Data Insight
The Thinker by Auguste Rodin (1882)
In my last Intelligent Edge blog post, Time For Database Spring Cleaning, I took on the topic of data hygiene and focused on the cleanliness and consistency of the data that is being entered into your CRM database. But these are only two components of a comprehensive data management plan.
This month, I’d like to build on the topic and highlight some additional – or adjacent – considerations. This is not exhaustive, but if you are interested in the health of your database, you should also be concerned about the laws and ethics that govern your data, as well as best practices around what to store and for how long.
***
Legal Considerations – in recent years, data privacy and compliance laws have quickly grown in number, depth and purpose. As individual people and consumers, they are designed to keep our personal data safe. As data and information professionals, they are numerous and cumbersome.
In addition to the ever-present General Data and Protection Legislation, or GDPR for short, which covers all of Europe, as of last count, 19 U.S. states have passed privacy laws (up from only 15 only a couple of months ago!). Many more have pending legislation. You can check out the IAPP’s fantastic website to track both pending and existing legislation.
In addition, a bill was introduced in Congress earlier in 2024 called the American Privacy Rights Act, or APRA for short (anyone else notice the irony that the acronym is APRA?), that introduces the idea of a national data privacy law.
And then, layer on industry specific regulations such as FERPA and HIPAA, that also govern what types of information can be collected, stored and shared, and with whom.
There’s a lot to keep up with!
My advice: educate yourself in the basics but consult with your organization’s general counsel or legal team for specific guidance. Some of these laws are straightforward and others are not. And, depending on the level of risk tolerance at your organization, you may see a different interpretation than at another nonprofit.
***
Ethical Considerations – above and beyond what is legal for us to collect, we should also consider what is ethical for us to be accessing, using and storing. After all, we are in an industry that places a high value on ethics – as it should – and many of our professional associations ask that we abide by their ethical standards.
Apra maintains an entire Ethics and Compliance Toolkit that is available to members and offers guidance on what to consider both broadly, as well as on a more nuanced basis such as how to appropriately use social media and an entire guide specifically focused on DEI considerations.
Also focused on DEI, aasp published DEI in Advancement Services earlier this year. It is another great resource that orients around three the aspects of good data practice: data acquisition, data storage and data usage.
Ethical considerations are certainly not always black-and-white. And, just like with the legal considerations, your organization may have a different threshold of what is acceptable or appropriate than another. Using the recommendations in these sources as guiding principles can be helpful in determining your own policies and procedures. But, always be sure to get leadership buying and organizational alignment before putting something into practice!
***
Data Minimization – lastly, but not any less important, is the emerging conversation about data minimization. It is estimated that there are more than 1.1 trillion megabytes of data created every day. Most of it sits around and does nothing, serves no purpose, and is clogging up databases across every industry.
I’m not focused on ‘every industry’ though – I’m focused on ours. Our databases collect a lot of data – as they should since they are our central and historical repository. We even sometimes refer to them as our “database of record.”
But some of the data in our databases is so old that it no longer serves a purpose. In fact, we may not even know proper definitions of what it is tracking/cataloging or the source/origin of where the data came from.
In reality, the topic of data minimization has grown out of the heightened focus on the legal and ethical considerations described above.
It’s also become a necessity in today’s world where data breaches are more common than ever. Simply stated: the less data being stored in your database, the less risk.
Two great resources to consider are the DEI in Advancement Services guide from aasp mentioned above, which also covers data retention, as well as Apra’s Data Minimization Toolkit (requires membership).
***
Good news! You’ve made it to the end of this blog post and you are hopefully more informed than you were at the start.
Unfortunately though, this is not the end of your journey. As with most things in our world, the laws, the best practice, and the guidance on these topics is ever evolving. So, to be a good steward of your organization’s data, I would encourage you to stay continual updated and informed on this changing landscape.
